NSE4 Practice Test 49 — 15 Questions

Question 1

An administrator needs to configure two-factor authentication for SSL VPN users using FortiToken. Which configuration is required on the FortiGate?

Accepted Answer

Enable FortiToken on the user account and configure the authentication scheme to require token. FortiGate requires two-factor authentication to be enabled on the user account itself (via the 'Two-factor Authentication' field set to 'FortiToken') and then an authentication scheme must be configured that includes a 'Token' requirement. This ensures that the user must provide both their password and a one-time token from the FortiToken device or app during SSL VPN login.

Answer

Enable two-factor authentication globally on the FortiGate

Answer

Install the FortiToken mobile app on the FortiGate

Answer

Create a separate firewall policy for token-based authentication

Question 2

A network administrator configures an application control profile to block social media applications. Users can still access Facebook through a web browser. What is the MOST likely reason?

Accepted Answer

Application control is not enabled for HTTPS traffic without deep inspection. Application control relies on deep inspection (SSL/TLS decryption) to identify applications within encrypted HTTPS traffic. Without deep inspection enabled, the FortiGate can only see the encrypted tunnel and cannot inspect the payload to determine that the traffic is Facebook, even if the application control profile is correctly applied. Option B is correct because HTTPS traffic must be decrypted via deep inspection for application control to function.

Answer

The application signatures are outdated

Answer

The firewall policy is in proxy-based mode

Answer

The application control profile is not applied to the correct policy

Question 3

Which of the following is a prerequisite for SSL deep inspection to work correctly on FortiGate?

Accepted Answer

A firewall policy that has SSL inspection enabled.. SSL deep inspection requires a firewall policy with SSL inspection enabled to intercept and decrypt HTTPS traffic. Without such a policy, the FortiGate cannot apply the CA certificate to re-encrypt traffic for inspection, making deep inspection non-functional.

Answer

A dedicated HTTPS firewall policy.

Answer

The FortiGate must be operating in proxy mode.

Answer

An active FortiCare license.

Question 4

A FortiGate is operating in transparent mode. The administrator needs to configure a new VLAN interface for segmenting traffic. Which statement about VLAN interfaces in transparent mode is correct?

Accepted Answer

VLAN interfaces can be created on physical interfaces and are layer-2 only, requiring no IP addresses for traffic forwarding.. In transparent mode, FortiGate acts as a layer-2 bridge, forwarding traffic based on MAC addresses. VLAN interfaces can be created on physical interfaces to segment traffic at layer 2, and they do not require IP addresses for forwarding; IP addresses are only needed for management access if desired.

Answer

VLAN interfaces require IP addresses and act as routed interfaces in transparent mode.

Answer

VLAN interfaces can only be created on physical interfaces, and each VLAN requires a separate IP address in the management VDOM.

Answer

VLAN interfaces are not supported in transparent mode; the administrator must switch to NAT/Route mode.

Question 5

When configuring SSL inspection, which type of inspection decrypts and inspects all HTTPS traffic including applications using non-standard ports?

Accepted Answer

Full SSL Inspection (Deep Inspection). Full SSL Inspection (Deep Inspection) is the correct answer because it performs a man-in-the-middle decryption and re-encryption of all HTTPS traffic, regardless of the port used. This allows the FortiGate to inspect the payload of encrypted sessions, including those on non-standard ports, for threats and policy violations.

Answer

SSL Offloading

Answer

Certificate Inspection

Answer

Flow-based Inspection

Question 6

A FortiGate admin configures an IP pool with type 'Fixed Port Range' to translate source IPs from 192.168.1.0/24 to 203.0.113.0/28 using port range 10000-20000. After applying the IP pool to a policy, some users cannot establish connections while others work. What is the MOST likely cause?

Accepted Answer

The IP pool's port range is exhausted because the number of internal hosts exceeds the number of available port ranges. Fixed Port Range NAT uses a one-to-one mapping of source IPs to unique port ranges. With a /28 pool (16 IPs) and port range 10000-20000 (10,001 ports), each internal host gets a dedicated port block. If more than 16 concurrent internal hosts attempt NAT, the pool is exhausted, causing connection failures for excess hosts. This matches the symptom where some users work and others do not.

Answer

The internal subnet is using RFC 1918 addresses that cannot be NATed

Answer

The IP pool is configured with overload enabled, causing conflicts

Answer

The firewall policy has NAT disabled

Question 7

Which of the following describes the implicit deny action in FortiGate firewall policies?

Accepted Answer

A default policy that denies all traffic unless explicitly allowed. In FortiGate firewall policies, the implicit deny is a default, system-generated rule that denies all traffic not explicitly permitted by any configured policy. It is always present at the end of the policy list and cannot be moved, modified, or deleted. This ensures that any traffic not matching an explicit 'accept' policy is automatically dropped, enforcing a default-deny security posture.

Answer

A policy that is automatically created when the first policy is added

Answer

A policy that denies traffic based on the source IP

Answer

A policy that denies all traffic and can be moved to any position

Question 8

What is the function of Zero Trust Network Access (ZTNA) on a FortiGate?

Accepted Answer

It allows users to securely access internal applications without a VPN, based on identity and device posture. ZTNA on FortiGate provides secure, identity-based access to internal applications without requiring a traditional VPN tunnel. It evaluates user identity and device posture before granting access, ensuring that only authorized users and compliant devices can reach specific applications. This aligns with the Zero Trust principle of 'never trust, always verify' and is implemented via FortiGate's ZTNA features, often integrated with FortiClient and FortiAuthenticator.

Answer

It replaces the firewall policy for all traffic

Answer

It encrypts all traffic between the FortiGate and the internet

Answer

It is a cloud-based subscription for antivirus updates

Question 9

A FortiGate is configured as a hub in a hub-and-spoke IPsec VPN. The spokes are remote branches. The hub has a Phase 2 selector set to 0.0.0.0/0 for both local and remote subnets. What is the advantage of this configuration?

Accepted Answer

It simplifies configuration by not needing specific subnet definitions per spoke. Using 0.0.0.0/0 as the Phase 2 selector on the hub allows the hub to accept any remote subnet from any spoke without defining each spoke's specific subnet in the Phase 2 configuration. This dramatically simplifies hub configuration in a hub-and-spoke topology because new spokes can be added without modifying the hub's Phase 2 selectors.

Answer

It reduces the number of IPsec SAs needed

Answer

It allows direct spoke-to-spoke communication without passing through the hub

Answer

It enables dynamic routing protocols over the VPN

Question 10

A FortiGate administrator configures a ZTNA rule to protect an internal web server. The rule uses an access proxy. Which component on the FortiGate terminates the incoming ZTNA connection?

Accepted Answer

ZTNA gateway. In FortiGate ZTNA, the access proxy is hosted on the FortiGate itself, and the component that terminates the incoming ZTNA connection from the endpoint is the ZTNA gateway (also called the access proxy gateway). The ZTNA gateway performs the TLS termination and enforces the ZTNA rule, then proxies the traffic to the protected internal server. This is why the FortiGate can inspect and apply zero-trust policy without exposing the server directly.

Answer

ZTNA tag

Answer

SSL inspection profile

Answer

ZTNA application

Question 11

A company has two FortiGate units in an active-active HA cluster. They want to ensure that sessions initiated from the internet through a virtual IP are synchronized to the peer unit in case of failover. Which HA setting is required?

Accepted Answer

Enable 'session-pickup' under config system ha. In a FortiGate active-active HA cluster, session-pickup (also called session synchronization) must be enabled under 'config system ha' to ensure that sessions — including those initiated through a virtual IP from the internet — are synchronized to the peer unit. Without session-pickup, a failover would drop existing sessions because the new primary has no state for them. This is the specific HA setting that controls whether firewall sessions are mirrored across cluster members.

Answer

Enable 'set ha-mgmt-status enable' on the WAN interface

Answer

Set 'set schedule' to 'round-robin' for the VIP

Answer

Configure the same virtual IP on both units

Question 12

An administrator wants to monitor real-time traffic flows on a FortiGate, specifically to see packet details for traffic matching certain criteria. Which command should the administrator use to capture live packets on an interface?

Accepted Answer

diagnose sniffer packet. The 'diagnose sniffer packet' command is FortiGate's built-in packet capture tool, allowing administrators to capture live packets on a specified interface with optional filters for host, port, and protocol. It provides real-time packet-level visibility similar to tcpdump, which is exactly what is needed to inspect packet details for traffic matching specific criteria.

Answer

diagnose debug enable and diagnose debug flow trace

Answer

diagnose sys session list

Answer

execute system grep from CLI

Question 13

A FortiGate administrator is diagnosing a performance issue. They notice that the CPU usage is consistently high. Which command can provide a real-time view of the processes consuming CPU?

Accepted Answer

diagnose sys top. 'diagnose sys top' provides a real-time, top-like view of running processes on the FortiGate, sorted by CPU and memory consumption, refreshing periodically. It is the correct tool to identify which specific process (e.g., ipsengine, wad, scanunitd) is driving sustained high CPU. This directly answers the need for a live process-level CPU view.

Answer

get system performance status

Answer

diagnose sys session stat

Answer

diagnose debug flow

Question 14

A FortiGate HA cluster is operating in active-passive mode. The active unit fails over to the passive unit. After the failover, some existing TCP sessions are dropped. What is the MOST likely cause?

Accepted Answer

Session synchronization is not enabled or not working properly. In an active-passive FortiGate HA cluster, the passive unit only maintains existing TCP sessions if session synchronization (session-pickup) is enabled and functioning. When the active unit fails, the passive unit becomes active and must have the session state to continue forwarding packets for established connections. If session synchronization is not enabled or is broken (e.g., due to a misconfigured sync interface or high latency), the new active unit has no knowledge of existing sessions and drops them, forcing clients to re-establish connections. Thus, the most likely cause is that session synchronization is not enabled or not working properly.

Answer

The HA heartbeat interface has a high latency

Answer

The failover time is too slow, causing TCP timeouts

Answer

The TCP sessions are using NAT, which cannot be synchronized

Question 15

An administrator is troubleshooting a FortiGate HA cluster that is experiencing frequent failovers. The heartbeat interfaces are configured on port1 and port2. Which diagnostic command should the administrator use to check heartbeat packet loss?

Accepted Answer

diagnose sys ha heartbeat. The 'diagnose sys ha heartbeat' command is the dedicated diagnostic tool for inspecting HA heartbeat interface statistics, including packet counts, errors, and loss on the configured heartbeat ports (port1 and port2 in this scenario). It shows per-interface heartbeat traffic details that directly reveal whether heartbeats are being dropped, which is the root cause of frequent failovers. This is the only option that targets heartbeat packet-level diagnostics rather than general HA state.

Answer

diagnose sys ha status

Answer

get system ha status

Answer

diagnose sys session list